CVE-2026-115362
Low · 2.2CVSS
2.2
EPSS
0.2%
Published
Oct 22, 2026
CISA due date
—
The record
OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63400 Coop is an open source review and moderation tool from ROOST. CWE-613
- CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password changed… CWE-613
- CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows… CWE-613
- CVE-2026-118665 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-613
- CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user store and… CWE-613
- CVE-2026-3583 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection… CWE-613
- CVE-2026-117499 @fastify/session is a session plugin for Fastify. CWE-613
- CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that… CWE-613